What’s Vulnerable › Vulnerabilities
CVE-2026-70601: Electron: Context isolation bypass via Function.prototype.bind hijack
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-05 · updated 2026-10-08
- Weakness: CWE-693
Description
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with nodeIntegration enabled, this may escalate to Node.js access. Apps are affected if they expose Promise-returning functions via contextBridge, the standard pattern for wrapping ipcRenderer.invoke, in windows that load untrusted content. This issue is fixed in versions 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5.
Affected products
- electron: before 39.8.9; from 40.0.0 before 40.9.2; from 41.0.0 before 41.2.2; 42.0.0-alpha1, 42.0.0-alpha2, 42.0.0-alpha3, 42.0.0-alpha4, 42.0.0-alpha5, 42.0.0-alpha6 (+4) — fixed in 39.8.9, 40.9.2, 41.2.2
How to fix
Upgrade to a fixed version: electron 39.8.9, 40.9.2, 41.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-70601 or the next vulnerability affects your stack